The problem So I hopped in a Discord voicechat to see my friends’ gaming streams. I would like to show them something so I tried to open streaming, but I couldn’t. There was nothing that popped o...
ArgvQuote - When passing argument is more complicated than you may assume When I researched the ways to exploit CreateProcess API, I encountered a post that posed a problem of arguments convention...
Win32 API - CreateProcessA This is an analysis of CreateProcessA, one of the most used Win32 APIs. Most of the information below is referenced from the Microsoft Docs of this API. “Creates a n...
Write-up | UTCTF 2026 | Watson Description We need your help again agent. The threat actor was able to escalate privileges. We’re in the process of containment and we want you to find a few thin...
Write-up | UTCTF 2026 | Landfall Description You are a DFIR investigator in charge of collecting and analyzing information from a recent breach at UTCTF LLC. The higher ups have sent us a triage...
Write-up | UTCTF 2026 | Half Awake Description Our SOC captured suspicious traffic from a lab VM right before dawn. Most packets look like ordinary client chatter, but a few are pretending to be...
Write-up | picoCTF 2022 | Torrent Analyze Description SOS, someone is torrenting on our network. One of your colleagues has been using torrent to download some files on the company’s network. Ca...
Write-up | picoCTF 2021 | Wireshark twoo twooo two twoo… Description Can you find the flag? shark2.pcapng Hint: Did you really *find the flag?* Look for traffic that seems suspi...
Write-up | picoCTF 2021 | Wireshark doo dooo do doo… Description Can you find the flag? shark1.pcapng Hint: (none) Walkthrough This is a .pcapng file, so I opened it in Wireshark as us...
Write-up | picoCTF 2019 | shark on wire 2 Description We found this packet capture. Recover the flag. Hint: (None) NOTE: I recommend reading the write-up of the previous part of this ch...